From 5943af79af254658237d1b222b69f17a3ffd08fd Mon Sep 17 00:00:00 2001
From: Stian Thorgersen <stianst@gmail.com>
Date: Wed, 5 Nov 2014 13:53:47 +0100
Subject: [PATCH 1/3] Update pom for 'examples/demo-template/example-ear' to
 not deploy to repo

---
 examples/demo-template/example-ear/pom.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/examples/demo-template/example-ear/pom.xml b/examples/demo-template/example-ear/pom.xml
index 1cd2488987..470113f6ac 100755
--- a/examples/demo-template/example-ear/pom.xml
+++ b/examples/demo-template/example-ear/pom.xml
@@ -60,6 +60,13 @@
                     </modules>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 </project>

From 5091e075550c807f86495439c327ea20c03c84d1 Mon Sep 17 00:00:00 2001
From: Stian Thorgersen <stianst@gmail.com>
Date: Wed, 5 Nov 2014 13:57:27 +0100
Subject: [PATCH 2/3] Fix label for certificate on realm-keys page

---
 .../theme/admin/base/resources/partials/realm-keys.html   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-keys.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-keys.html
index 7da6bc62fc..9545c60597 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-keys.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-keys.html
@@ -5,9 +5,6 @@
     <div id="content">
         <h2><span>{{realm.realm}}</span> Realm Public Key <span tooltip-placement="right" tooltip="Realm's public key.  This is used to verify any signed tokens or documents created by the realm." class="fa fa-info-circle"></span></h2>
         <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
-            <div class="pull-right form-actions" data-ng-show="access.manageRealm">
-                <button class="btn btn-primary btn-lg" type="submit" data-ng-click="generate()">Generate new keys</button>
-            </div>
             <fieldset class="border-top">
                 <div class="form-group">
                     <label class="col-sm-2 control-label" for="publicKey">Public key</label>
@@ -18,7 +15,7 @@
                     </div>
                 </div>
                 <div class="form-group">
-                    <label class="col-sm-2 control-label" for="publicKey">Certificate</label>
+                    <label class="col-sm-2 control-label" for="certificate">Certificate</label>
 
                     <div class="col-sm-10">
                         <textarea type="text" id="certificate" name="certificate" class="form-control" rows="5"
@@ -26,6 +23,9 @@
                     </div>
                 </div>
             </fieldset>
+            <div class="pull-right form-actions" data-ng-show="access.manageRealm">
+                <button class="btn btn-primary btn-lg" type="submit" data-ng-click="generate()">Generate new keys</button>
+            </div>
         </form>
     </div>
 </div>
\ No newline at end of file

From e7625c2bb127f5c47312fd6119b8b88ba49aa763 Mon Sep 17 00:00:00 2001
From: Stian Thorgersen <stianst@gmail.com>
Date: Wed, 5 Nov 2014 15:34:56 +0100
Subject: [PATCH 3/3] KEYCLOAK-820 Don't expose realm private key through admin
 endpoints

---
 .../exportimport/util/ExportUtils.java        |  2 +-
 .../models/utils/ModelToRepresentation.java   | 14 ++++++++------
 .../resources/admin/RealmAdminResource.java   |  2 +-
 .../resources/admin/RealmsAdminResource.java  |  2 +-
 .../testsuite/admin/AbstractClientTest.java   |  2 ++
 .../keycloak/testsuite/admin/RealmTest.java   | 19 ++++++++++++++++++-
 .../keycloak/testsuite/model/ModelTest.java   |  2 +-
 7 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportUtils.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportUtils.java
index 14e3a1ef2f..c9ba3dd806 100755
--- a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportUtils.java
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportUtils.java
@@ -45,7 +45,7 @@ import java.util.Set;
 public class ExportUtils {
 
     public static RealmRepresentation exportRealm(KeycloakSession session, RealmModel realm, boolean includeUsers) {
-        RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm);
+        RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm, true);
 
         // Audit
         rep.setEventsEnabled(realm.isEventsEnabled());
diff --git a/model/api/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java b/model/api/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
index 7d431c320a..0be1dc7460 100755
--- a/model/api/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
+++ b/model/api/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
@@ -75,7 +75,7 @@ public class ModelToRepresentation {
         return rep;
     }
 
-    public static RealmRepresentation toRepresentation(RealmModel realm) {
+    public static RealmRepresentation toRepresentation(RealmModel realm, boolean internal) {
         RealmRepresentation rep = new RealmRepresentation();
         rep.setId(realm.getId());
         rep.setRealm(realm.getName());
@@ -85,13 +85,15 @@ public class ModelToRepresentation {
         rep.setUpdateProfileOnInitialSocialLogin(realm.isUpdateProfileOnInitialSocialLogin());
         rep.setSslRequired(realm.getSslRequired().name().toLowerCase());
         rep.setPublicKey(realm.getPublicKeyPem());
-        rep.setPrivateKey(realm.getPrivateKeyPem());
-        String privateKeyPem = realm.getPrivateKeyPem();
-        if (realm.getCertificatePem() == null && privateKeyPem != null) {
-            KeycloakModelUtils.generateRealmCertificate(realm);
+        if (internal) {
+            rep.setPrivateKey(realm.getPrivateKeyPem());
+            String privateKeyPem = realm.getPrivateKeyPem();
+            if (realm.getCertificatePem() == null && privateKeyPem != null) {
+                KeycloakModelUtils.generateRealmCertificate(realm);
+            }
+            rep.setCodeSecret(realm.getCodeSecret());
         }
         rep.setCertificate(realm.getCertificatePem());
-        rep.setCodeSecret(realm.getCodeSecret());
         rep.setPasswordCredentialGrantAllowed(realm.isPasswordCredentialGrantAllowed());
         rep.setRegistrationAllowed(realm.isRegistrationAllowed());
         rep.setRememberMe(realm.isRememberMe());
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
index a8f3707c52..b2766bb058 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
@@ -158,7 +158,7 @@ public class RealmAdminResource {
     @Produces("application/json")
     public RealmRepresentation getRealm() {
         if (auth.hasView()) {
-            RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm);
+            RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm, false);
             if (session.realms() instanceof CacheRealmProvider) {
                 CacheRealmProvider cacheRealmProvider = (CacheRealmProvider)session.realms();
                 rep.setRealmCacheEnabled(cacheRealmProvider.isEnabled());
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java
index 0eab7ef3b8..e434738dc1 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java
@@ -100,7 +100,7 @@ public class RealmsAdminResource {
 
     protected void addRealmRep(List<RealmRepresentation> reps, RealmModel realm, ApplicationModel realmManagementApplication) {
         if (auth.hasAppRole(realmManagementApplication, AdminRoles.MANAGE_REALM)) {
-            reps.add(ModelToRepresentation.toRepresentation(realm));
+            reps.add(ModelToRepresentation.toRepresentation(realm, false));
         } else if (auth.hasOneOfAppRole(realmManagementApplication, AdminRoles.ALL_REALM_ROLES)) {
             RealmRepresentation rep = new RealmRepresentation();
             rep.setRealm(realm.getName());
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/AbstractClientTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/AbstractClientTest.java
index 9a57d39004..e0d29e980b 100755
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/AbstractClientTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/AbstractClientTest.java
@@ -7,6 +7,7 @@ import org.keycloak.admin.client.Keycloak;
 import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.models.Constants;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.representations.idm.ApplicationRepresentation;
 import org.keycloak.representations.idm.OAuthClientRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
@@ -42,6 +43,7 @@ public abstract class AbstractClientTest {
 
                 RealmModel testRealm = manager.createRealm(REALM_NAME);
                 testRealm.setEnabled(true);
+                KeycloakModelUtils.generateRealmKeys(testRealm);
             }
         });
 
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/RealmTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/RealmTest.java
index d3bbca982e..6626b60ab6 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/RealmTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/RealmTest.java
@@ -6,7 +6,11 @@ import org.keycloak.models.RealmModel;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.services.managers.RealmManager;
 
+import java.util.List;
+
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
 /**
@@ -16,7 +20,15 @@ public class RealmTest extends AbstractClientTest {
 
     @Test
     public void getRealms() {
-        assertNames(keycloak.realms().findAll(), "master", "test", REALM_NAME);
+        List<RealmRepresentation> realms = keycloak.realms().findAll();
+        assertNames(realms, "master", "test", REALM_NAME);
+
+        for (RealmRepresentation rep : realms) {
+            assertNull(rep.getPrivateKey());
+            assertNull(rep.getCodeSecret());
+            assertNotNull(rep.getPublicKey());
+            assertNotNull(rep.getCertificate());
+        }
     }
 
     @Test
@@ -65,6 +77,11 @@ public class RealmTest extends AbstractClientTest {
         RealmRepresentation rep = realm.toRepresentation();
         assertEquals(REALM_NAME, rep.getRealm());
         assertTrue(rep.isEnabled());
+
+        assertNull(rep.getPrivateKey());
+        assertNull(rep.getCodeSecret());
+        assertNotNull(rep.getPublicKey());
+        assertNotNull(rep.getCertificate());
     }
 
 }
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/ModelTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/ModelTest.java
index 2346bd8545..eb64196284 100755
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/ModelTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/ModelTest.java
@@ -67,7 +67,7 @@ public class ModelTest extends AbstractModelTest {
     }
 
     private RealmModel importExport(RealmModel src, String copyName) {
-        RealmRepresentation representation = ModelToRepresentation.toRepresentation(src);
+        RealmRepresentation representation = ModelToRepresentation.toRepresentation(src, true);
         representation.setRealm(copyName);
         representation.setId(copyName);
         RealmModel copy = realmManager.importRealm(representation);